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Amendments In the Claims 

Please cancel Claims 3, 1 1, and 18. Please amend claims 1, 9, 16, 23, 24, 25, 26, 27, 28 
and 29 as follows: 



1 . (Currently Amended) A method of collecting network traffic data comprising: 
receiving a group of information; 

determining whether to process the group of information for network traffic data 
collection according to a sampl e algorithm , wherein 

said determining is performed according to a sampling algorithm that is 
selected from one of 
a linear sampling algorithm, 
an exponential sampling algorithm, 
a natural log sampling algorithm, 
a burst sampling algorithm, and 

selecting the group of information based on an examination of traffic 
attribute data in the group of information ; 

processing the group of information for network traffic data collection if the 

determination is to process the group of information; and 
forwarding the group of information to a destination. 

2. (Original) The method of Claim 1 wherein the group of information is an IP 

packet. 

3. (Canceled) 

4. (Original) The method of Claim 1 wherein forwarding the group of information 
to the destination comprises: 

identifying the destination using a forwarding table; 

if the destination is in the forwarding table, automatically forwarding the group of 

information to the destination; and 
otherwise sending the group of information to one or more processing engines to 

determine routing to the destination and forwarding the group of information 

according to the determined routing. 
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5. (Original) The method of Claim 1 wherein forwarding the group of information 
to the destination is performed after processing the group of information. 

6. (Previously Presented) The method of Claim 1 wherein the processing of the 
group of information for network traffic data collection comprises: 

determining if the group of information is part of one or more recorded traffic flows; 
creating a new entry in a table if the group of information is not part of the one or more 

recorded traffic flows; 
incrementing a field in an existing entry in the table if the group of information is part of 

the one or more recorded traffic flows; and 
time stamping the group of information. 

7. (Previously Presented) The method of Claim 6 wherein the processing of the 
group of information for network traffic data collection further comprises: 

creating a traffic information packet; and 

transmitting the traffic information packet to a network traffic data collection application. 

8. (Original) The method of Claim 7 wherein the traffic information packet 
comprises a header and one or more flow records. 

9. (Currently Amended) An apparatus for collecting network traffic data 
comprising: 

means for receiving a group of information; 

means for determining whether to process the group of information for network traffic 
data collection according to a sample algorithm , wherein 
the means for determining comprises a means for sampling selected from one 
of 

a means for linear sampling, 
a means for exponential sampling, 
a means for natural log sampling, 
a means for burst sampling, and 
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a means for selecting the group of information based on an 
examination of traffic attribute data in the group of 
information ; 

means for processing the group of information for network traffic data collection if the 

determination is to process the group of information; and 
means for forwarding the group of information to a destination. 

10. (Original) The apparatus of Claim 9 wherein the group of information is an IP 

packet. 

11. (Canceled) 

12. (Original) The apparatus of Claim 9 wherein the means for forwarding the group 
of information to the destination comprises: 

means for identifying the destination using a forwarding table; 

means for automatically forwarding the group of information to the destination if the 

destination is in the forwarding table; and 
means for sending the group of information to one or more processing engines to 

determine routing to the destination and then forward the group of information 

according to the determined routing otherwise. 

13. (Previously Presented) The apparatus of Claim 9 wherein the means for 
processing of the group of information for network traffic data collection comprises: 

means for determining if the group of information is part of one or more recorded traffic 
flows; 

means for creating a new entry in a table if the group of information is not part of the one 

or more recorded traffic flows; 
means for incrementing a field in an existing entry in the table if the group of information 

is part of the one or more recorded traffic flows; and 
means for time stamping the group of information. 
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14. (Previously Presented) The apparatus of Claim 13 herein the means for 
processing of the group of information for network traffic data collection further comprises: 

means for creating a traffic information packet; and 

means for transmitting the traffic information packet to a network traffic data collection 
application. 

15. (Original) The apparatus of Claim 14 wherein the traffic information packet 
comprises a header and one or more flow records. 

16. (Currently Amended) A network node for collecting network traffic data having 
one or more processing engines and a memory comprising a set of instructions to: 

receive a group of information; 

determine whether to process the group of information for network traffic data collection 
according to a s ampl e algorithm , wherein 

the set of instructions to determine comprises a sampling algorithm that is 
selected from one of 
a linear sampling algorithm, 
an exponential sampling algorithm, 
a natural log sampling algorithm, 
a burst sampling algorithm, and 

selecting the group of information based on an examination of traffic 
attribute data in the group of information ; 

process the group of information for network traffic data collection if the determination is 

to process the group of information; and 
forward the group of information to the destination. 

17. (Original) The network node of Claim 16 wherein the group of information is an 
TP packet. 

18. (Canceled) 

19. (Original) The network node of Claim 16 wherein the set of instructions to 
forward the group of information to the destination comprises a set of instructions to: 
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identify the destination using a forwarding table; 

if the destination is in the forwarding table, automatically forward the group of 

information to the destination; and 
otherwise send the group of information to one or more processing engines to determine 

routing to the destination and forward the group of information according to the 

determined routing. 

20. (Previously Presented) The network node of Claim 16 wherein the set of 
instructions to process the group of information for network traffic data collection comprises a 
set of instructions to: 

determine if the group of information is part of one or more recorded traffic flows; 
create a new entry in a table if the group of information is not part of the one or more 
recorded traffic flows; 

increment a field in an existing entry in the table if the group of information is part of the 

one or more recorded traffic flows; and 
time stamp the group of information. 

21 . (Previously Presented) The network node of Claim 20 wherein the set of 
instructions to process the group of information for network data collection further comprises a 
set of instructions to: 

create a traffic information packet; and 

transmit the traffic information packet to a network traffic data collection application. 

22. (Original) The network node of Claim 21 wherein the traffic information packet 
comprises a header and one or more flow records. 

23. (Currently Amended) An apparatu s for collecting n e twork traffic data A 
router comprising: 

one or more route proce ss ors; 

one or more switch fabrics coupled to the one or more route proce s sor s; 

one or more destination line cards coupled to the one or more switch fabrics; 
a source line card coupled to one of the one or more switch fabrics, wherein the sourc e 
lin e card 
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the source line card receives a data packet group of information ; 
a router processor, coupled to the switch fabric, and configured to 

determines whether to process the data packet group of information for 

network traffic data collection according to a sample algorithm; 
processes the data packet group of information for network traffic data 

collection if the determination is to process the data packet group of 

information ; and 

forwards the data packet group of information to one of the one or more 
destination line cards. 

24. (Currently Amended) The apparatus of Claim 23 wherein the data packet 
group of information is an IP packet. 

25. (Currently Amended) The apparatus of Claim 23 wherein the sample algorithm 
is selected from one of a linear sampling algorithm, an exponential sampling algorithm , a 
natural log sampling algorithm, a burst sampling algorithm, and selecting the data packet 
based on an examination of traffic attribute data in the data packet traffic attribute . 

26. (Currently Amended) The apparatus of Claim 23 wherein to forward the data 
packet group of information to one of the one or more destination line cards, the source line 
card: 

identifies the one of the one or more destination line cards using a forwarding table; 
if the one of the one or more destination line cards is in the forwarding table, 

automatically forwards the data packet group of information to the one of the 

one or more destination line cards; and 
otherwise sends the data packet group of information to on e or more the router 

processors ing engine s to determine routing to one of the one or more destination 

line cards and then forwards the data packet group of information according to 

the determined routing. 

27. (Currently Amended) The apparatus of Claim 26 wherein the router processor 
on e or more proces s ing engines is located on the source line card. 
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28. (Currently Amended) The apparatus of Claim 23 wherein to process the data 
packet group of information for network traffic data collection, the source line card: 

determines if the data packet group of information is part of one or more recorded 
traffic flows; 

creates a new entry in a table if the data packet group of information is not part of the 

one or more recorded traffic flows; 
increments a field in an existing entry in the table if the data packet group of 

information is part of the one or more recorded traffic flows; and 
time stamps the data packet group of information . 

29. (Currently Amended) The apparatus of Claim 28 wherein to process the data 
packet group of information for network traffic data collection, the source line card further: 

creates a traffic information packet; and 

transmits the traffic information packet to a network traffic data collection application. 

30. (Original) The apparatus of Claim 29 wherein the traffic information packet 
comprises a header and one or more flow records. 



-8- 



SerialNo.: 09/779,248 



